IAEA-TECDOC Application of Reliability Centred Maintenance to Optimize Operation and Maintenance in Nuclear Power Plants

Transcription

1 IAEA-TECDOC-1590 Application of Reliability Centred Maintenance to Optimize Operation and Maintenance in Nuclear Power Plants May 2007

2 IAEA-TECDOC-1590 Application of Reliability Centred Maintenance to Optimize Operation and Maintenance in Nuclear Power Plants May 2007

3 The originating Section of this publication in the IAEA was: Nuclear Power Engineering Section International Atomic Energy Agency Wagramer Strasse 5 P.O. Box 100 A-1400 Vienna, Austria APPLICATION OF RELIABILITY CENTRED MAINTENANCE TO OPTIMIZE OPERATION AND MAINTENANCE IN NUCLEAR POWER PLANTS IAEA, VIENNA, 2008 IAEA-TECDOC-1590 ISBN ISSN IAEA, 2008 Printed by the IAEA in Austria May 2008

4 FOREWORD In order to increase Member States capabilities in utilizing good engineering and management practices the Agency has developed a series of Technical Documents (TECDOCs) to describe best practices and members experience in the application of them. This TECDOC describes the concept of Reliability Centred Maintenance (RCM) which is the term used to describe a systematic approach to the evaluation, design and development of cost effective maintenance programmes for plant and equipment. The concept has been in existence for over 25 years originating in the civil aviation sector. This TECDOC supplements previous IAEA publications on the subject and seeks to reflect members experience in the application of the principles involved The process focuses on the functionality of the plant and equipment and the critical failure mechanisms that could result in the loss of functionality. When employed effectively the process can result in the elimination of unnecessary maintenance activities and the identification and introduction of measures to address deficiencies in the maintenance programme. Overall the process can result in higher levels of reliability for the plant and equipment at reduced cost and demands on finite maintenance resources. The application of the process requires interaction between the operators and the maintenance practitioners which is often lacking in traditional maintenance programmes. The imposition of this discipline produces the added benefit of improved information flows between the key players in plant and equipment management with the result that maintenance activities and operational practices are better informed. This publication was produced within IAEA programme on nuclear power plants operating performance and life cycle management. The IAEA wishes to express its gratitude to all experts who provided contributions and to all the reviewers listed at the end of this publication. The IAEA officer responsible for this publication is F. Hezoucky of the Division of Nuclear Power.

5 EDITORIAL NOTE The use of particular designations of countries or territories does not imply any judgement by the publisher, the IAEA, as to the legal status of such countries or territories, of their authorities and institutions or of the delimitation of their boundaries. The mention of names of specific companies or products (whether or not indicated as registered) does not imply any intention to infringe proprietary rights, nor should it be construed as an endorsement or recommendation on the part of the IAEA.

6 CONTENTS 1. INTRODUCTION Background Description Structure RELIABILITY CENTRED MAINTENANCE Maintenance and Reliability Centred Maintenance (RCM) RCM as a tool for Optimization of Operations and Maintenance activities The Principles of RCM The RCM Process Basic Steps Preparation Analysis Task Selection Task Comparison Task Comparison Review Records PRACTICAL APPLICATIONS System Selection System Boundaries Required Materials and Documentation Plant Personnel Interviews Functional Failure Modes Effects and Criticality Analysis (FMECA) System Functions System Functional Failure Identification of Equipment Identification of Failure Modes Identification of Failure Effects Criticality Maintenance criteria for Non-Critical components Reliability and Performance Data collection and processing Use of PSA to support RCM analysis Systems selection Identification of critical components The impact of the maintenance activity changes on Plant Risk The Increased Allowed Outage Time (AOT) PSA Capability and Insights Task Selection Task Selection Guidance Maintenance Templates Task Selection Hierarchy Task Options Non Critical Components Task Selection Review Final Phase of Analysis Perform Task Comparison... 18

7 4. DEVELOPMENT AND DEPLOYMENT Management Involvement Project Management Analytical and Software Tools Databases Use of Contractors Conditions Monitoring Programme Skills and Competences Project Management Skills Training Performance Indicators Integration into O&M Process Implementing recommendations Living RCM Factors for consideration in RCM implementation BENEFITS Primary Goals of RCM - Reliability Cost Benefits Contribution to Long Term Operation Soft Operations and Maintenance interaction Justification of maintenance tasks Feed back quality improved A culture of economic performance Questioning Attitude REFERENCES GLOSSARY ABBREVIATIONS ANNEX I STREAMLINED RCM ANNEX II EXPERIENCE OF RCM IN EDF ANNEX III RCM AT NPP DUKOVANY, CZECH REPUBLIC ANNEX IV RCM EXPERIENCE IN ASCO/VANDELLOS, SPAIN ANNEX V ANNEX VI THE APPLICATION OF RCM TECHNIQUES WITHIN BRITISH ENERGY THE APPLICATION OF RCM TECHNIQUES IN THE UNITED STATES OF AMERICA ANNEX VII RCM AT KOZLODUY NPP, BULGARIA CONTRIBUTORS TO DRAFTING AND REVIEW... 87

8 1. INTRODUCTION 1.1. Background The power industry worldwide has been the subject of major reviews and reforms in recent years, which have resulted in changing demands in respect of enhanced safety, reliability, environmental safeguards and commercial competition. In such an environment it is essential that the personnel and the plant and equipment involved, perform to their optimum levels of capability. Reliability Centred Maintenance is a maintenance Optimization tool which has a role in providing an effective response to such demands on the industry, by enhancing the effectiveness of operations and maintenance programmes. This TECDOC supplements other IAEA publications by both describing the principles and basic steps in the Reliability Centered Maintenance concept, its relationship with established maintenance programmes and by providing insights into the practical application of the concept in Nuclear Power Plants (NPPs) based on international experience. This document may be used by maintenance practitioners seeking to optimize the use of maintenance resources and enhance the safety and reliability of Nuclear Power Plants Description Reliability centered maintenance (RCM) is a technique initially developed by the airline industry that focuses on preventing failures whose consequences are most likely to be serious. RCM was developed in the late 1960s when wide-body jets were being introduced into service. Because of the increased size and complexity of these aircraft, airlines were concerned that the continuing use of traditional maintenance methods would make the new aircraft uneconomical. Previously, preventive maintenance was primarily time-based (e.g., overhauling equipment after a certain number of hours of flying time). In contrast RCM is condition-based, with maintenance intervals based on actual equipment criticality and performance data. After adopting this approach, airlines found that maintenance costs remained about constant, but that the availability and reliability of their aircraft improved because effort was spent on maintenance of equipment most likely to cause serious problems. As a result, RCM is now used by most of the world's airlines. In 1984 the Electric Power Research Institute (EPRI) introduced RCM to the nuclear power industry. Part of the motivation was that the preventive maintenance programmes at many nuclear power plants were based on vendors' overly conservative recommendations, without sufficient consideration of actual duty cycles or overall system functions. In other cases, too little preventive maintenance was performed on key components that had not been identified as critical, leading to failures that increased corrective maintenance costs and reduced plant availability. The utilities which comprise the EPRI RCM Users Group have accepted the following definition for their use: "Reliability centered maintenance (RCM) analysis is a systematic evaluation approach for developing or optimizing a maintenance programme. RCM utilizes a decision logic tree to identify the maintenance requirements of equipment according to the safety and operational consequences of each failure and the degradation mechanism responsible for the failures. " 1

9 1.3. Structure This TECDOC describes the principles of RCM, some practical examples for its application in NPPs, key requirements for its implementation, experience in its application and examples of the practical benefits. 2. RELIABILITY CENTRED MAINTENANCE 2.1. Maintenance and Reliability Centred Maintenance (RCM) The relationship between RCM and traditional maintenance practices can best be summarised as follows: Plant and equipment are installed and employed to do what the users want them to do. Maintenance is undertaken in a variety of forms, to ensure that the plant and equipment continues to do what the users want it to do. Reliability Centred Maintenance determines what maintenance needs to be performed and what testing and inspection needs to be performed to support the maintenance strategy. The outcomes of an RCM analysis can result in changes to existing preventive maintenance tasks, the use of condition monitoring, inspections and functional testing, or the addition or elimination of such tasks. Figure 1 shows the structure of maintenance. Fig.1. Maintenance Structure. When used effectively it can result in the enhancement of safety and reliability of plant and equipment and the optimization of operations and maintenance activities. RCM is not a process, which will result in short term benefits, so those adopting it should be prepared for a 5 to 10 year payback term. 2

10 2.2. RCM as a tool for Optimization of Operations and Maintenance activities RCM is a decision making tool. Operations and maintenance programmes can benefit both the processes involved in the decision-making, soft benefits and the outcomes, that result in the changes to maintenance and operations programmes. The following are some examples: The act of performing the RCM decision-making process provides a benefit in promoting better co-operation among all of those involved in the process. The process demands that all established tasks are challenged with the objective of justifying continued use or removing/replacing them with other tasks, in doing so it promotes a healthy questioning attitude. The process raises awareness of the functions of the systems involved, the consequences of failure of those functions and the economics of operating and maintaining them. The clear aims of RCM are to improve reliability and optimise the cost effectiveness of maintenance activities. When performed effectively it will result in the elimination of unnecessary maintenance tasks and the introduction of measures to address omissions and deficiencies in maintenance programmes The Principles of RCM The RCM analysis process centres on the functions of plant and equipment, the consequences of failure and measures to prevent or cope with functional failure. The process must establish answers to the following questions and an effective response to them:- What are the functions and performance standards of the plant? In what ways does it fail to fulfil its functions? What causes each functional failure? What happens when each failure occurs? In what way does each failure matter? What can be done to predict or prevent each failure? What should be done if a suitable proactive task cannot be found? 2.4. The RCM Process Basic Steps RCM is not a stand-alone process, it must be an integral part of the Operations and Maintenance programmes. The introduction of the RCM process will involve changes to established working processes. For the successful introduction of such changes it will be important that management demonstrate their commitment to the changes, possibly in the form of a policy statement and personal involvement and that measures are taken to establish the engagement of those who will be involved or affected by the changes. RCM works best when employed as a bottom up process, involving those working directly in the operation and maintenance of the plant and equipment Preparation The preparatory phase has a number of steps which basically involve the selection of the systems to be analysed, gathering the necessary data for the analysis. In addition the ground rules or criteria to be used in the selection and analysis process must be established. For 3

11 example; Key Assumptions, Critical Evaluation Criteria, Non Critical Evaluation Criteria and Establishment of a review process. The stages can be summarised as follows: System Selection Definition of the system boundaries Acquisition of Documentation and Materials Interviews with Plant Personnel These stages will be discussed in more detail later in the document Analysis Once the systems have been selected for analysis and the preparations have been completed the analysis can commence. Experience in the analysis process is important for effective decision-making. Such experience may exist in the utility or it may be bought in from specialist service providers in this area. The data contained in formal systems is usually very comprehensive but knowledge management is not so well developed in NPPs that all experience is captured in data basis. For this reason it is important that personnel with local experience in the operation and maintenance of the plant are involved in the analysis process. The first stage of the analysis process therefore is the assembly of a team with a suitable range of qualifications and experience for the task. The analysis involves the following stages. Identification of System Functions System Functional failure analysis Equipment identification Reliability and Performance Data collection Identification of failure modes Identification of failure effects Determination of Component Criticality Task Selection When the analysis has been completed the next part of the process is to allocate suitable maintenance tasks to the systems and equipment identified in the analysis process, in accordance with the significance ascribed to them, be they critical or non-critical. This part of the process will seek to establish the most cost effective means of delivering the maintenance strategy in respect of achieving safety, reliability, environmental and economic goals. The task selection process uses various forms of logical decision making to arrive at conclusions in a systematic manner. The outcomes can include: Preventive maintenance Condition monitoring Inspection and functional testing Run to Failure 4

12 Task Comparison When the task selection has been completed and reviewed, the recommendations arising from the task selection process will be compared against the current maintenance practices. The purpose of this comparison is to identify the changes needed to the maintenance programme and the impact on resources and other commitments Task Comparison Review The outputs of the analysis will result in a change to the maintenance programme. It is important that such changes are consistent with the maintenance philosophy of the plant and with regulatory and social obligations. For this reason it is important that the process and its outcomes be subjected to a final review Records RCM should form part of a living programme. The outcomes of the analysis process and the implementation of the recommendations will have an impact on the effectiveness of the operations and maintenance programmes. It is important therefore, that all decisions, the basis for them and those involved in making them are effectively recorded, so that the information is available to those carrying out subsequent reviews of the maintenance strategy System Selection 3. PRACTICAL APPLICATIONS The preparation phase of the RCM process involves the collection of data, drawings and experienced personnel that will be an integral part of the analysis and decision making process. In addition selection and review criteria must be established to ensure that the efforts of specialist plant personnel are well focussed and used productively in the process. One approach is to use PSA in the system selection process. (See Section 2.6), Using the criteria it should be evident to the analysts at the outset, that there will be some added value in applying the process to the system, either as a result of defining measures that will result in enhanced reliability or through optimised use of finite resources. If that is not the case the effort would be better placed on other systems System Boundaries In order to further focus the analysis, it is necessary to define system boundaries. Usually plant coding systems can be used but these are often incomplete, so some form of review process will be required to ensure that all necessary plant and equipment has been included in the selected system. In addition, plant and equipment functionally related to, but which is not part of, the system as described in the plant coding, must be included. The analysis team should use all the latest drawings and databases and consider plant walk downs to verify completeness and accuracy where that is feasible. System boundaries are often delineated as: Mechanical: includes all static and rotating plant equipment. 5

13 Electrical: must include not only the plant equipment such as motors and transformers but also power sources, control supplies and circuit breakers associated with them. Control and instrumentation: in addition to those components within the system, components outside the system which could impact the functionality of the system must be included. For example, electrical control and instrument air or control air supplies. By considering only the instruments within the system or pressure switches and control valves, the analysts could make the vital error of assuming that the control supplies will always be available. The analysis process will require the analysts to make decisions about what components to include or omit from the process. There is no infallible methodology, process or analytical tools to do this, so the experience and judgement of the analysts will be important for an effective outcome to the process Required Materials and Documentation The system or process description (operations manuals) Plant, Piping and Instrument Drawings Schematic Drawings of electrical and I&C systems Plant and equipment list for mechanical, electrical and I&C Lists of Preventive Maintenance and Technical Specification Testing and Inspection programmes. Plant vendor drawings and manuals Plant maintenance history (including corrective maintenance) Regulatory and insurance obligations, operating instructions, alarm response procedures and operator records. PSA analysis for the system where that is available Plant Personnel Interviews In the absence of comprehensive documentation and records of systems, it can be of use to conduct interviews with experienced plant personnel to obtain their perspective of the history of the plant. Very often, station personnel such as Electrical, Mechanical and Instrumentation Engineers/Foremen/Supervisors or Senior Craft Personnel, as well as Operations Engineers or Senior Operators can provide valuable input to the analysis. Time constraints, schedules, personnel availability and station operating conditions are all to be considered when deciding upon a format for the interviews. Typically, the analysis will involve interviewing an individual or group, expert in a particular discipline: e.g. Mechanical, Electrical, I&C, Operations, Engineering. It is important for the analysts to be knowledgeable (though not expert) on the system and components under analysis, and to be capable of drawing difficult to obtain information out from the interviewees. Such interviews will be a standard feature of the RCM process. When station personnel participate in the analysis there will be accompanying benefits derived from the interaction among plant personnel which can be in the form of improved team working, cross functional co-operation and enhanced knowledge of system functionality. 6

14 3.5. Functional Failure Modes Effects and Criticality Analysis (FMECA) Classical RCM focuses on the functional failures of systems and components. A systematic process is employed to determine the functions of physical assets, failure modes, consequences of failure, their significance and hence their criticality. In its most comprehensive form this process is described as a failure modes effects and criticality analysis or FMECA. The electricity, gas and the automotive industry have typically used a simplified form of the process which is FMEA. Some utilities have developed checklists that are designed to follow the logical steps of the process without explicitly defining each of the steps. Checklists are used to assist the assessment of the consequences of equipment failure. The checklists implicitly assume that the failure modes of the equipment and the impact of systems functions are understood System Functions Every physical asset has one or more functions to perform. The objective of maintenance is to ensure that those assets continue to perform their functions. In the RCM process the first step of the analysis requires that the functions of the selected system be defined. Simple schematic diagrams illustrating the system components, flow paths and interactions are useful. Physical assets usually have a primary function which is often defined by the name of the asset, e.g. condensate extraction pump. Secondary functions are not so easy to identify but are critical to the successful outcome of the RCM process. For example an auxiliary boiler might supply steam to a key production process as its primary function and provide factory heating as its secondary function System Functional Failure For each function described, there must be at least one functional failure mode/mechanism. The functional failure statement documents the mechanism of failure for the function and its consequences Identification of Equipment For the analysis, the process requires the identification of all equipment, whose failure could result in the functional failure. This can be accomplished by tracing the flow paths in the function. All mechanical (rotating and stationary) equipment, valves, pumps, filters, heat exchangers and vessels etc must be included. Similarly electrical equipment such as motors, circuit breakers and relays, together with all associated I&C equipment must be identified. It is important to identify the equipment in terms of equipment type as well as its unique application within the system under review. This treatment potentially enables the analysts to access a broader equipment reliability database for relevant data Identification of Failure Modes The failure of a component such as a valve to open or close or the failure of a pump to start or stop are termed failure modes by analysts, in that they describe the nature of the failures 7

15 rather than the causes of the failure. This simple definition of failure mode is typically used in reliability and PSA (probabilistic safety analysis). Maintenance practitioners would normally go further and define why the failure occurred, e.g. valve spindle wear, actuator defects, or in the case of pumps, related switchgear defects. The latter comes closer to the safety analyst definition of failure causes In the RCM process definitions of failure mode typically align with those of the safety analysts. Failure mode is used to describe plant conditions such as, fails to open or fails to close, while the term failure causes typically describes the degradation mechanism that gives rise to a failure mode Identification of Failure Effects The analysts will need to identify the effects of functional failures on safety, the environment, personnel safety and plant performance. The list produced will need to contain all the information the analysts will require to enable them to devise suitable countermeasures to mitigate the consequences. For example, how will failure be identified, what are the consequences of failure, what remedial options and countermeasures are available Criticality A component is defined as critical if its failure effects are intolerable to the facility. As an example, in a Nuclear Power Plant a component could be regarded as critical if a failure results in any one of the following: The failure results in a reactor trip or shut down necessity before regularly planned outages, The failure results in a reduction in power or efficiency; The failure results in exceeding a technical specification limit; The failure results in an increased personnel safety hazard; The failure results in significant damage; The failure results in a violation of environmental release limits; The failure results in a radiation release to the public; The failure results in a fire. When assessing criticality, the evaluator should take credit for redundancy in a system, where it exists. For example, in an application in which there are two 100% capacity pumps (which may be used interchangeably) neither pump would be considered critical since the logical assumption is that if the operating pump failed the other pump would be available and used. It is important to note here that the analyst evaluates for only a single failure, hence the assumption that the second pump would be available. In such a situation the pressure or flow switch that is designed to ensure the standby pump cut in on failure of the duty pump would be considered critical. In addition it may be possible to provide a component function by some other components, not specifically a second train of the same thing. For example, another valve in the system may provide the ability to provide the function of the first valve, even though it is not technically a redundant valve in the design. 8

16 Probabilistic Safety Analysis (PSA) can be used as part of the criticality determination for safety related issues, see section Maintenance criteria for Non-Critical components Non-Critical (i.e., failure of this component can be tolerated). Once a component is deemed Non-Critical, the component is evaluated to identify if there is a Preventive Maintenance task that should be performed or to determine whether the item should be considered for Run to Failure. Examples of criteria are used to determine run to failure: Is there a high repair or replacement cost if the component is run to failure? Will the component s failure induce failures in other critical components? Is there a simple PM task that will prevent severe degradation of the component s inherent reliability (e.g. bearing lubrication, filter cleaning)? Will the component s failure cause a potential personnel hazard if the component is run to failure (i.e. hazard from a PM task may be less than the hazard from a corrective action upon failure or the actual failure itself)? Is the component needed to support the performance of a recommended critical component maintenance activity, or is it significant to the operators? Is there excessive Corrective Maintenance (CM) performed on this component that should be eliminated (i.e. does the CM history imply that a PM task may be less costly in terms of manpower and materials than the current maintenance regime). An affirmative answer to any of these questions implies that a PM task should be selected for the component. If there are no affirmative answers to any of these criteria, then the best option is for the component to be Run to Failure Reliability and Performance Data collection and processing Existing manufacturing data and plant history databases are the primary sources of data on which RCM analysis will be based. Ongoing data derived from plant inspections, condition monitoring and maintenance activities will provide future data. One of the tasks of the analyst is to assess the adequacy and completeness of the data available and to prescribe the information that must be gathered from future activities. Databases can be supplemented with information derived through interviews with experienced operations and maintenance practitioners Use of PSA to support RCM analysis The PSA can be used in combination with deterministic approaches, for optimization of plant maintenance program whilst maintaining safety level at the same time. PSA can be used in the following three activities: Systems selection based of the systems/components safety significance. Maintenance assessment and alternate strategies based on identification of the system critical components. Assessment of the impact of the proposed changes to Maintenance activities to the plant risk. 9

17 Regulatory Guide discusses the overall approach for using PSA in risk-informed decisions on plant-specific changes [14] Systems selection The method for systems selection for application of risk-informed approach of RCM is based on systems categorization according to their safety significance (NEI 00-04, [15]). Summary of the Categorization process based on NEI is shown on Figure 2. Risk Characterization HSS Internal Event Risks Fire Risks Seismic Risks Other External Risks Shutdown Risks LSS Defense-in-Depth Characterization HSS LSS Risk Sensitivity Study Human error Component common cause Maintenance unavailability Others studies HSS LSS Integrated Decisionmaking Panel (IPD) Review Operating Experience Engineering DBA/Licensing Requirements PSA HSS LSS Safety Significant Low Safety Significant Fig. 2. Summary of the Categorization process. The PSA model provides the initial input information for the risk characterization process. It uses two PSA importance measures: risk achievement worth (RAW) and Fussell-Vesely (F- V), as screening tools to identify potentially safety-significant components/systems. Risk reduction worth (RRW) can be used also as an acceptable measure instead of F-V. The importance measure criteria used to identify possible safety significant components/systems are: Sum of F-V for basic events of interest including common cause events > RAW for basic event of interest > 2. RAW for corresponding common cause failure basic event > 20. In determining the RAW and F-V values, it is important to identify the basic events (or group events) associated with the train s key component related to random failure and common cause failure. If any of these criteria are exceeded, the component/system is considered a safety significant candidate. In order to provide an overall assessment of the risk significance of components/systems an integrated quantification is performed using the available importance measures. This integrated importance measure accounts for the relative importance of each risk contributor 10

18 (internal events, fire, seismic) to the overall core damage frequency. The integrated importance assessment will determine if component/system that is categorized as potentially HSS based on a hazard with a low contribution to CDF should remain with a potentially HSS categorization. The systems that have low impact on the risk (LSS), and accordingly on plant safety are of primary interest. The systems, defined as HSS, are also of interest, but the potential changes to the Maintenance should be directed to keeping of the current level of availability and reliability of the system Identification of critical components A reliability centred maintenance (RCM) approach requires identification of the critical components of the systems. The critical components are those whose failures can lead to the failure of the system/train. Identification of those components on the quantitative basis is based on reliability (or unavailability) models developed using fault trees for each system function. In the RCM process, the PSA can be used as a souarce of information for: System functions and functional failures. Component failure modes. Component failure probability. System reliability model. The system functions of interest are those that directly support the objective of the RCM program. Identification of functional failures is required for each system function of interest. The functional failures identify how the system can fail and how that will affect the function of interest. The component failure modes present information on how the component failure results in system (or train) functional failure. Identification of component failure modes relates directly to system functioning and to the way the component supports this function. The component failure probabilities used in the PSA model are determined using the information for components failure. The specific individual failures that are used as input to the failure probability need to be re-examined in terms of the RCM process. The PSA model may use different component boundaries than those of interest in the RCM program. The basic events for the components of interest should be expanded to sub-components with their associated failure probabilities, were it is possible. This will allow identifying the Maintenance activities currently performed on the level of sub-component failure mode. In accordance with the RCM program objectives some changes in the systems reliability models should be done. These changes are addressed to: Component (and system) unavailability due to test activities and Maintenance activities or repair. Common cause failures. Applicability of the human errors. Support systems (power supply, service water and the system actuation signals). 11

19 The quantification of the systems unavailability model will identify components failures that lead to system failure and their order of importance to the system failure. The critical components of the system are determined based on importance measure criteria for Risk Reduction Worth and Risk Аchievement Worth. Figure 3 presents the process of critical components identification. System Model Quantification RRW >1.005 Yes No RAW > 2 Yes Critical components High RRW? Yes Improvement of the reliability by change of technical maintenance activities No No Non-critical components Keeping the current level of the availability Candidate run-to-failure. Fig. 3. Critical Components Identification Process. On the basis of the information about currently performed Maintenance activities for critical and non-critical components, as well as importance criteria assessment of Maintenance activities can be made and several strategies for modifications of those activities can be defined The impact of the maintenance activity changes on Plant Risk Determination of the impact of the proposed maintenance activity changes on plant safety requires risk assessment. The potential impact of these changes can result from one of the following sources: Component reliability. Component availability. Restoration human errors. Component reliability impacts on the plant risk in all modes in which the component is required for accident mitigation. This includes shutdown modes, transition modes and atpower mode. The risk impact can be directly determined from a re-quantification of the PSA model using the revised component failure probability. 12

20 Component unavailability impacts on the plant risk only in these modes when the component will be out of service. If the alternate (or new) activity will be completed at-power or if current activities will be moved to at-power operation, then the additional component unavailability needs to be factored into the model and the PSA model should be re-quantified. In addition, monitoring regimes must be established to determine the impact of such changes. In order to quantify the risk impact it will be necessary to perform the following two groups of calculations: The impact of each individual change on CDF and LERF The cumalative impact of changes on CDF and LERF The Increased Allowed Outage Time (AOT) Performance of Maintenance activities during power operation could be limited by the Allowed Outage Time (AOT), defined in the Unit Technical Specification. In the USA Regulatory Guide [16] it is recommended a three-tiered approach of the assessment of changes of the Allowed Outage Times in the Technical Specification. evaluation of the impact on plant risk of the proposed TS change; identification of potentially risk-significant plant configurations; establishment of an overall configuration risk management program. The Tier 1 of this process includes assessment of the impact of the incremental conditional core damage probability (ICCDP) and the incremental conditional large early release probability (ICLERP), additionally to the estimated impact to CDF and LERF. The objective of Tier 2 is to assure that the risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed AOT change is out of service. The contribution to the risk can be determined by the minimal cutsets list or accident sequences associated with the conditional CDF and LERF quantifications PSA Capability and Insights In order to support the estimation of the proposed changes to the Technical Specification on the basis of the given assessments (CDF, ICCDP, LERF, ICLERP) it is necessary to demonstrate that the PSA model is of appropriate quality. The requirements for the PSA scope and level of detail for risk-informed RCM approach application are discussed in IAEA-TECDOC-1511 [17] and ASME RA-S-2002 [18] Task Selection Task Selection Guidance When determining the tasks (maintenance activities) it is important to remember that the aim is to prevent the loss of function. Performing the task selection phase of the RCM analysis 13

21 within the guidelines listed below will ensure that the PM program will be based on maintaining reliability. Identify tasks that specifically address the dominant failure mechanisms; Identify existing reliability issues; Identify approaches to resolve existing reliability issues and intolerable failure mechanisms; Do not use task selection to justify the existing maintenance program; Do not assume that the frequencies of current maintenance tasks are correct/optimum because few failures have been experienced; Identify tasks to prevent the effects of failure consequences rather than to prevent the equipment failure. (Predictive Maintenance); Do not recommend tasks that will not prevent the effects of equipment failure, extend the mean time between failures, or identify a hidden failure. A logic tree is often used to select applicable maintenance tasks see example as shown in Figure 4. FUNCTIONALLY 1. For each functional failure mode, is there an applicable condition directed preventive maintenance task (or tasks) that will prevent functional failures? No 2. Is there an applicable time directed PM task (or tasks) that will prevent functional failures? Yes Yes No No 3. Can this failure be managed or tolerated during station operation? Yes 4. Is the functional failure evident? No Yes Identify failure indication. 5. Select an applicable failure finding task. Redesign to reduce Implement tasks. Fig. 4. Logic Tree Example. 14

22 Maintenance Templates The Logic Tree Analysis (LTA) process is the step used to determine the most applicable, cost-effective Preventive Maintenance tasks for a component. These recommended tasks are typically a function of component importance, design, usage and service environment. With no common guidance provided to different analysts, use of the LTA can result in different PM recommendations for similar components with the same characteristics of criticality, environment and component usage. Variations in an RCM analyst s experience will also contribute to the length of time required to research appropriate PM tasks for a specific component type. To achieve greater efficiency and consistency between analysts in the determination of the ideal PM program for a specific component type, the PM Review can use templates as much as practical. Each template is designed to maintain the LTA process of emphasising condition-directed tasks versus time-directed tasks for each component type, and identifies the most applicable and effective preventive maintenance tasks and associated task frequencies considering several component characteristics, such as component failure importance, component usage and service environment. Below is a summary of the format of a typical Maintenance Template. Each maintenance template has tasks divided into four categories: Condition monitoring tasks, such as thermography, ferrography, vibration, eddy current and acoustic monitoring; Time-directed tasks, such as clean and inspect, lubricate, overhaul and calibration check; Surveillance (failure finding) tasks, such as functional tests; Economic run-to-failure considerations. Not all of the tasks in the template need to be performed. The tasks selected to be performed on a component will be influenced by the failure causes that the analyst determines to be dominant and worthy of prevention/identification in the PM program. This is combined with the maintenance philosophy of the station in the cost-effective application of various predictive maintenance technologies (condition monitoring) Task Selection Hierarchy When selecting tasks, there is a hierarchy of task types and that should be followed. This hierarchy is based on minimizing overall maintenance costs while maintaining plant reliability and availability. Task types should be selected from the following, listed in order of preference: (1) Performance Monitoring (e.g., visual inspections, monitored process parameters such as temperature, pressure, flow) (2) Predictive Maintenance (e.g.,vibration monitoring, thermography, lube oil analysis) (3) Non-Intrusive Maintenance (e.g., oil change, grease) (4) Intrusive Maintenance (e.g., internal inspection) (5) Renewal (e.g., bearing replacement, complete overhaul) 15

23 Responsible personnel-based tasks should be selected from the following, also listed in order of preference: (1) Actions operators may perform as part of normal rounds (visual inspection) (2) Actions operators may perform that are not a part of normal rounds (functional test) (3) Actions requiring minimal craft skill (simple lubrication) (4) Actions requiring skilled craft work (detailed inspection) (5) Time-based intrusive maintenance (complete rebuild by craft / contractor) Both of the above hierarchical lists are founded on the same principle of selecting tasks preferentially from least intrusive to most intrusive, from least manpower intensive to most manpower intensive and from least to most costly. A cost effective maintenance program should utilise existing activities when possible. For example an operator that is quite familiar with the equipment operation performs task such as monitoring temperatures and pressures and functionally testing equipment as part of their routine. Developing a maintenance task for a craftsperson to specifically perform these activities is often not the best utilisation of manpower. To be successful, both departments must take responsibility to rely on each other in knowing the monitoring or testing will be done, and that if abnormalities are found, quick response will be provided. By minimizing intrusive inspections and rebuilds/overhauls, there is less chance of introducing failures due to human error and infant mortality of new parts. In addition general maintenance costs are reduced (rebuilds and overhauls are costly in terms of labour, materials and down-time) Task Options There are some criteria to be considered prior to deciding the type of task to select for a piece of equipment (condition directed, time based, failure finding) Condition Directed Tasks For condition directed tasks to be applicable it must be possible to detect reduced failure resistance for a specific failure mechanism. The task must be able to detect the potential failure condition and there must be a reasonable, consistent amount of time between the first indication of potential failure and the actual failure. More specifically, however, when determining the frequency for condition monitoring tasks, the frequency should be consistent with the time interval between the first indication of potential failure (a threshold value ) and the actual time of failure to allow a condition directed task to be carried out Time Based Tasks For time based overhaul tasks to be applicable there must be an identifiable age at which the component displays a rapid increase in the conditional probability of failure. A large proportion of the same equipment type must survive to that age, and it must be possible to restore the original failure resistance to the component through rebuild or overhaul (or else the component must be replaced periodically). In determining frequency for time-based tasks, past failure history and maintenance experience should be consulted, as should vendor recommendations if the equipment is operated in a manner consistent with vendor 16

24 assumptions. Normally, the frequency will be based on the expected mean time between failures and the time between incidences of unacceptable degradation Failure Finding Tasks For failure finding tasks to be applicable, the component must be subject to a failure mechanism that is not evident to personnel during normal operation of the equipment and there is no other applicable and effective type of task to prevent the failure from occurring. Functional tests are useful failure finding tasks for protective features and interlocks. However, it must be assured that the test fully verifies the feature. If a device is supposed to block operation of a valve or pump start, make sure this function is tested, not just that the input works properly. When determining frequency for failure finding tasks, consideration should be given to the expected frequency of demand, failure rate and tolerability of failure. Also, it must be remembered that performing the failure finding task may increase the amount of wear or degradation in the component, and/or may place the system in an unsafe or abnormal condition Non Critical Components For non-critical components, maintenance tasks should only be selected if they are cost effective to perform. If no cost effective maintenance can be defined the components should be run-to-failure. This does not mean that the component is to be run to destruction or other significant effect the component would have had routine maintenance recommended to prevent that. It means that there is no applicable, cost-effective maintenance that should be done to it, the consequences of run-to-failure are tolerable, and the failure is obvious to operators or maintenance personnel. Note that run-to-failure may imply that spare parts should be on hand, or easily obtainable, to repair or replace the component upon failure. In summary, for all equipment in the RCM analysis, both critical and non critical, it is recommended that a logic tree is used to determine the most applicable and effective planned maintenance tasks and periodicity. This approach will ensure that the Preventive Maintenance program developed is complete and effective while being firmly reliability-based Task Selection Review The Task Selection results need to be reviewed with appropriate facility personnel. This is to assure that plant personnel agree that the selected tasks are reasonable and capable of being implemented. The analysts should provide tasks that are a challenge to the present program to foster new thinking, more in line with the functional nature of the analysis. The intent is to maintain system functions, not just the components Final Phase of Analysis Task Selection has been completed and reviewed, the analyst is ready to begin the final phase of the RCM analysis, the comparison of the selected or recommended tasks developed in the analysis with the facility s current planned maintenance program. The purpose of this comparison is to identify needed changes in the existing program, and thereby optimise the facility s Preventive Maintenance program. The comparison also provides another check of the analysis to assure validity of assumptions and completeness and gaps derived between RCM analysis and existing Preventive Maintenance program. 17